





An adventure in GPS tracking 






Had this one hit me like a wall of bricks... 



Arrived at facility 

Determined records management / tape 
storage company before walking int he 
door... 
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This company used to tout a few things that 
made them more secure 
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Some are still true 



Highly secure storage 

Well defined and audited security 
procedures 

Unmarked vehicles 
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IRON MOUNTAIN 

RECORDS MANAGEMENT 

Protecting the world's information. 

WWVM IKUN MOUNT* 

^0N ■ 



^^H I ^i^&ty 



■ 



.v- M 



^m 



m 



i& 




Now I know where 
to find them 






Where else do they 
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Who are some of 
their other 
customers? 
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How do we find out? 



A 



Need a device that can log GPSWaypoint 



data 



Small form factor 
Battery operated 
Inexpensive 
Weather resistant 



SatelSle 

Based 

CdT«llon 




GPS & Radio Beacon 
"Reference Receiver" 



Real-time Differential GPS 



The module 



Cat Track 









Weather resistant, small 
CatTraq.com 



Records waypoints every 19 seconds to 
internal memory 

1 Sync with PC software via USB sled 

Yes, intended to track your pets... 




So, turns out the batter is good, 
but not good enough... ~30 
hours 

Use a MintyBoost from LadyAda 

• It will charge and record at 
the same time 

Extends battery life as long as 
you can provide it power (D- 
cells anyone?) 










Place the battery pack and GPS data logger 
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in a container 



Spray with truck bedliner? 
Add high power magnet 
Attach to vehicle 




GUNS DON'T KILL PEOPLE 



KILL PEOPLE 







So, I'm not exactly sure about the 
legality of tracking third party vehicles 



Working to determine more 

Attaching home-made electronic 
devices to a third party vehicle 

> This looks like a good way to have 
the black helicopters and 
Suburbans show up at your door 

• Next generation could include 
cellphone for SMS waypoint 
upload... 



ustrative 




decided to track something that I could 
legally (to the best of my knowledge) 

Myself... 

Ok, that got boring real fast. 

Another vehicle in the household... 

Put in cardboard box and hid under front 
seat 
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Pulled data off of device 
with windows interface 






Only picking one interesting 
example 

> Took a drive at lunch to 
verify locations 




Oh, by the way Paul, we need to talk. 



What can we 
determine about this 



track? 






GPS waypoints have 
been moved to protect 
the innocent/guilty. 

Let's analyze... 
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This little diversion 
happened to be a 
residence 



• One that I recognized 
- mom's house! 

A call revealed yes, she 
did babysit for a while... 
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Yet another diversion 
> The local Stop & 
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Several waypoints at the 
location reveal that 
about an hour passed... 

Note the diversion in 
track - likely no stop on 
the way back 
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Yes, they offer other services 



florist, meats, pharmacy. 
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So what does the pharmacy sell? 
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StopaShop' 



Shop Online 
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avings 



Shop Onlin 



Pharmacy 



Yes, they offer other services 
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brist, meats, pharmacy.. 
So what does the pharmacy sell? 
How I know this? 
Sneaky, found separate receipt 
Ooooh, the "family pack"! 




All The Ingredients 

STOP S _SH0P *~^^ 
728 7 7720 

HI I'M SUSAN -""-,. " ,vh^ 

Iran 31.222 Terminal 11 Cashier 03125 



Customer Card Number 
GROCER 



Subtotal 
1 otal 
C ash 

( hange 



2.73 * 
2.79 * 

$5.53 

$5.53 

$6.03 

$0.42 



THANK VU) FOR SHOPPING AT STOP 8 SHOP. 
WE'VE Eh JOYED SERVING YOU, AND WE 
LOOK >0F WARD TO SERVING ALL YOUR 
FUTURE SHOPPING NEEDS. 



JEFF GREENBERG, STORE MGR. 
STOP & SHOP * 



AMERICA'S #1 CONDOM 
TRUSTED FOR OVER 80 YEARS 

Help Reduce the Kisfc of Pflffuncy jnd Snually Traramtttd Diseases. 
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Final destination 



Thought I recognized 
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Paul, don't worry, I'm not mad. 

Waypoints in close to same location often 
indicate the passage of time... 

These waypoints revealed something 
interesting 









Total time from arrival to departure: 






Total time from arrival to departure: 



(talk about low expectations) 
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sometimes you find 
out information 
than you want to 
know 

So why do it to 
begin with? 




May be valid for both penetration testers and 
attackers! 






Discover other customers based on stops 

Discover timeframe for an attack based on 
location 

How about determining key locations to 
determine process weaknesses? 

> Can you say B&E and grand larceny? 



Learn some things from the Armored car 
industry 

> Vary paths 

> Randomize stop times 

• Both still have the same endpoints! 
• Vehicle sweep for devices 

• What about the insider threat? 
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Fortunately, my daughter doesnt look like Paul. 



